CVE-2023-46655

2023-10-2513:45:56

jenkins

www.cve.org

jenkins

cloudbees cd

plugin

vulnerability

arbitrary file

publishing

cve-2023-46655

7.1 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.3%

JSON

Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the ‘CloudBees CD - Publish Artifact’ post-build step, allowing attackers able to configure jobs to publish arbitrary files from the Jenkins controller file system to the previously configured CloudBees CD server.

CNA Affected

[
  {
    "vendor": "Jenkins Project",
    "product": "Jenkins CloudBees CD Plugin",
    "versions": [
      {
        "version": "0",
        "versionType": "maven",
        "lessThanOrEqual": "1.1.32",
        "status": "affected"
      }
    ],
    "defaultStatus": "unaffected"
  }
]